Rogue access point detection and restriction

Abstract

A method for securing a network having a number of access points which comprises detecting a rogue access point and responsive to the detecting, hindering a client from accessing the network via the rogue access point. The network comprises a number of access points and a first device having stored thereon a list of access points determined to be acceptable access points. The network is structured to enable communication between the first device and a second device through at least one of the number of access points. Furthermore, the network is structured to hinder the second device from accessing the first device via an access point other than an acceptable access point.

1 . A method for securing a network, comprising: 
 detecting a rogue access point; and    responsive to said detecting, performing an action on at least one of said network and at least some of a number of clients.    
   
   
       2 . The method of  claim 1  wherein said detecting a rogue access point comprises: 
 detecting a number of access points;    gathering information related to at least some of said number of access points;    comparing one of said at least some of said number of access points to a list of access points; and    determining that said one of said at least some of said number of access points is a rogue access point.    
   
   
       3 . The method of  claim 2  wherein said detecting a number of access points includes detecting at least some of said number of access points with said at least some of a number of clients.  
   
   
       4 . The method of  claim 2  wherein said gathering information related to at least some of said number of access points includes gathering information related to a first one of said at least some of said number of access points with at least one of said at least some of a number of clients and another one of said at least some of said number of access points.  
   
   
       5 . The method of  claim 2  wherein said comparing one of said at least some of said number of access points to a list of access points includes comparing said one of said at least some of said number of access points to a list of access points stored on said at least some of a number of clients.  
   
   
       6 . The method of  claim 2  wherein said comparing one of said at least some of said number of access points to a list of access points occurs at least one of when said at least some of a number of clients attempt to connect to said network and attempts to roam from a first access point to said one of said at least some of said number of access points.  
   
   
       7 . The method of  claim 2  further comprising updating said list of access points in response to said gathered information.  
   
   
       8 . The method of  claim 7  wherein said updating said list of access points includes: 
 transmitting a signal representative of at least some of said information from said at least some of a number of clients to said server; and    responsive to said transmitting, updating on said server said list of access points to generate an updated list of access points.    
   
   
       9 . The method of  claim 8  further comprising communicating to said at least some of a number of clients a signal representative of at least a portion of said updated list of access points.  
   
   
       10 . The method of  claim 1  further comprising generating at least one of a list of acceptable access points and a list of rogue access points.  
   
   
       11 . The method of  claim 10  wherein generating a list of acceptable access points comprises: 
 determining that each of at least some of a number of access points is an acceptable access point; and    adding at least a first said acceptable access point to said list of acceptable access points.    
   
   
       12 . The method of  claim 11  wherein said generating a list of acceptable access points further comprises listing at least one of an extended service set identifier associated with said at least a first said acceptable access point and a basic service set identifier associated with said at least a first said acceptable access point.  
   
   
       13 . The method of  claim 10  wherein generating a list of rogue access points comprises: 
 determining that at least a first access point from among a number of access points is a rogue access point; and    adding said rogue access point to said list of rogue access points.    
   
   
       14 . The method of  claim 2  wherein said gathering information related to at least some of said number of access points includes gathering, for each access point of said at least some of said number of access points, at least one of an extended service set identifier and a basic service set identifier associated with said access point.  
   
   
       15 . The method of  claim 14  wherein said comparing one of said at least some of said number of access points to a list of access points includes comparing a service set identifier associated with said one of said at least some of said number of access points to a service set identifier associated with an acceptable access point.  
   
   
       16 . The method of  claim 1  wherein said performing an action includes at least one of hindering at least one of said number of clients from accessing said network via said rogue access point, updating a list of acceptable access points stored on at least one of said number of clients, updating a list of rogue access points stored on at least one of said number of clients, continuously issuing disassociation requests from trusted access points, flooding said rogue access point, and locating said rogue access point through triangulation.  
   
   
       17 . The method of  claim 16  wherein said hindering comprises limiting access to said network by at least one of said number of clients to acceptable access points.  
   
   
       18 . A network comprising: 
 a number of access points; and    a first device having stored thereon at least one of a list of access points determined to be acceptable access points and a list of access points determined to be rogue access points;    wherein said network is structured to enable communication between said first device and a second device through at least one of said number of access points determined to be acceptable access points, and wherein said network is structured to hinder said second device from accessing said first device through at least one of said number of access points determined to be a rogue access point.    
   
   
       19 . The network of  claim 18  wherein said first device is structured to generate and communicate to said second device at least one of said list of access points determined to be acceptable access points and said list of access points determined to be rogue access points, each of at least some of said number of access points determined to be acceptable access points and each of said number of access points determined to be rogue access points having at least one of an extended service set identifier and a basic service set identifier associated therewith.  
   
   
       20 . The network of  claim 19  wherein said first device is structured to make a comparison between a prospective access point and said list of access points determined to be acceptable access points, and responsive to said comparison, determine that said prospective access point is an acceptable access point.  
   
   
       21 . The network of  claim 19  wherein said first device is structured to make a comparison between a prospective access point and said list of access points determined to be rogue access points, and responsive to said comparison, determine that said prospective access point is a rogue access point.  
   
   
       22 . The network of  claim 18  wherein said second device includes at least one of said list of access points determined to be acceptable access points and said list of access points determined to be rogue access points stored thereon, each access point of at least a portion of said at least one of said list of access points determined to be acceptable access points and said list of access points determined to be rogue access points having a service set identifier associated therewith.  
   
   
       23 . The network of  claim 22  wherein said second device is structured to make a comparison between a prospective access point and said list of access points determined to be acceptable access points and, responsive to said comparison, determine that said prospective access point is an acceptable access point.  
   
   
       24 . The network of  claim 22  wherein said second device is structured to make a comparison between a prospective access point and said list of access points determined to be rogue access points and, responsive to said comparison, determine that said prospective access point is a rogue access point.  
   
   
       25 . The network of  claim 18  wherein said network is structured to hinder said second device by at least one of limiting access to said network by the second device to acceptable access points, updating at least one of said a list of access points determined to be acceptable access points and a list of access points determined to be rogue access stored on said first device, updating at least one of said a list of access points determined to be acceptable access points and a list of access points determined to be rogue access stored on said second device, flooding said rogue access point, and locating said rogue access point through triangulation.  
   
   
       26 . The network of  claim 18  wherein said first device is one of a server, an access controller, and another electronic device and said second device is a client.  
   
   
       27 . A method of controlling access to a wireless network comprising: 
 maintaining at least one of a list of acceptable access points and a list of rogue access points; and    transmitting to a client at least a portion of at least one of a list of acceptable access points and a list of rogue access points.    
   
   
       28 . The method of  claim 27  wherein said maintaining includes storing information associated with each of at least some of a number of access points that are acceptable.  
   
   
       29 . The method of  claim 27  further comprising hindering a client from accessing said network via an access point that is not contained on said list of acceptable access points.  
   
   
       30 . The method of  claim 27  further comprising detecting a number of access points and transmitting from said client to said server information associated with at least some of said number of access points.